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CALLER ID SPOOFING 


THURSDAY, JUNE 21, 2007 

U.S. Senate, 

Committee on Commerce, Science, and Transportation, 

Washington, DC. 

The Committee met, pursuant to notice, at 11:03 a.m., in room 
SR-253, Russell Senate Office Building, Hon. Bill Nelson, pre- 
siding. 


OPENING STATEMENT OF HON. BILL NELSON, 

U.S. SENATOR FROM FLORIDA 

Senator Nelson. Good morning. Over the past few years, con- 
sumers have been hit with a number of new scams that seek to use 
our Nation’s telecommunications network for fraudulent purposes, 
from pretexting to spyware. Fraudsters are always looking for new 
ways to invade our privacy and personal and financial information 
and one of the newest scams is called Caller ID Spoofing. 

It’s a technique that allows a telephone caller to alter the tele- 
phone number and other information that appears on the recipi- 
ent’s Caller ID system. It’s an easy scam to pull. All an individual 
needs to do is go to one of a number of Internet sites with names 
like Tricktell.com and SpoofTell.com, to gain access to spoofing 
services and on these sites, an identify thief can pay money to 
order a spoofed telephone, tell the website what telephone number 
they wish to reach and then place a spoofed telephone call through 
a toll-free line. A number of recent news stories have highlighted 
the serious harm that is caused by this practice. 

One recent example — fraudsters used Caller ID spoofing to pose 
as court officers calling to say that the individual had missed jury 
duty. The caller then says that a warrant will be issued for their 
arrest unless they pay a fine with a credit or bank card during the 
call and you know what the result is going to be. 

In another case, identity thieves and criminals have used Caller 
ID spoofing to hack into a bank account and into voicemail ac- 
counts to steal sensitive personal information. 

Now while these examples are serious enough, just think what 
could happen if a stalker used Caller ID spoofing to trick someone 
into answering their phone and providing information on where 
they are and the results could be tragic. So it’s time to put an end 
to Caller ID spoofing. 

The bipartisan Truth in Caller ID Act of 2007 will plug the hole 
in the current law and make it clear that spoofing is a scam and 
is not legal. So it is my privilege to chair this hearing on behalf 
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of Senator Inouye and the Vice Chairman of the Committee, I 
would turn to him, Senator Stevens. 

STATEMENT OF HON. TED STEVENS, 

U.S. SENATOR FROM ALASKA 

Senator Stevens. Thank you very much. Senator. I’m grateful to 
Senator Inouye for calling this hearing. These ID services provide 
us all with information that we need. Really, I’m delighted to have 
the information. When I see who is calling me, I can tell whether 
to pick it up right away or ask my staff to deal with it if it is some- 
thing that I don’t have the time for. 

This idea that some people can alter that ID information bothers 
me considerably because it means that a loss of privacy means 
identity theft possibilities and really as Senator Nelson has men- 
tioned, can compromise personal safety. We need to understand 
those concerns and to try to make a record and that’s what we’re 
going to do today with your help so that others will review what 
this panel gives us to determine what holes are in our laws and 
if they can be filled to address and prevent this spoofing practice. 

I’m particularly worried about the fraudulent aspects that Sen- 
ator Nelson has mentioned, particularly where it could lead to ob- 
taining money under totally false pretenses. It ought to be against 
the law already but I want to find out if there is any way and any- 
one in law enforcement working to deal with that directly at this 
time. Senator Nelson, Senator Snowe and Senator McCaskill have 
introduced this bill. It’s going to come before the Committee next 
week and this will be the only hearing, the only opportunity we 
have to get a record for other members to learn about this. So I’m 
particularly concerned about the law enforcement actions that have 
been taken. I congratulate the sponsors but will it provide the tools 
that law enforcement needs to really improve enforcement activi- 
ties and will it provide the information that is necessary? 

I’d like to see something developed and invented so that if I see 
something on my Caller ID that I want to preserve then I could 
transfer it. We lose that immediately — once we hang up, we’ve lost 
that ID. What the telephone records might show would be one 
thing but what has shown on ID is another thing, is my under- 
standing. Though somehow or another, we’ve got to be able to find 
a way to preserve that information to show the fraudulent activi- 
ties involved. And we get a great many calls from around the coun- 
try and when we get a Caller ID that indicates to us it’s a governor 
or it’s someone from major organization and we’re working on that 
legislation, we ought to be able to rely on that ID. 

This fraudulent ID concept goes to really, I think contact vio- 
lating the Constitutional concept that people have the right to con- 
tact Congress to redress wrongs, but if they are contacting us 
under false pretences, we’ve got to have a way to know it. So I 
think this is a very important piece of legislation. I do hope the 
record will help us convince the other members of the Committee 
of that fact. 

I look forward to the hearing. Unfortunately, I have to go some- 
where at half past, so I’ll wrap up. 

Senator Nelson. Well, Senator Stevens, thank you for your en- 
couraging and supportive comments. And here’s another example. 
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A couple of years ago, a sharp-shooting SWAT team shut down a 
neighborhood in New Brunswick, New Jersey, after they received 
what they thought was a distress call coming from an apartment 
in the neighborhood and it turned out it was a spoof call and it put 
a lot of lives at risk, time after time. 

Well, we’ve got a distinguished panel. Ms. Kris Monteith, Chief 
of the Enforcement Bureau of the FCC, Mr. Jerry Cerasale, Senior 
Vice President of Government Affairs of the Direct Marketing Asso- 
ciation, Ms. Allison Knight, Staff Counsel and Director of Privacy 
and Human Rights Project, Electronic Privacy Information Center 
and Mr. Ron Jones, Director of the Tennessee Regulatory Authority 
and Chairman of the Consumer Affairs Committee of the National 
Association of Regulatory Utility Commissioners. So welcome, all. 

Your written statements are entered into the record and because 
of the constraints of time, I would appreciate it if you could talk 
directly to us. We’ll go right in the order in which I introduced you, 
without you reading your testimony to us because we’re going to 
have it as part of the record, if you would give us your thoughts. 
So let’s start with you, Ms. Monteith. 

STATEMENT OF KRIS ANNE MONTEITH, CHIEF, 
ENFORCEMENT BUREAU, FCC 

Ms. Monteith. Good morning. Thank you very much. Vice 
Chairman Stevens, Senator Nelson and members of the Committee. 
Thank you for the opportunity to speak with you today about the 
problem of caller identification spoofing. As you’ve stated. Caller ID 
services lets customers identify who’s calling them before they pick 
up the phone, such as by a telephone number, a name or business 
number displayed on the customer’s equipment. Caller ID spoofing 
refers to the practice in which the Caller ID information is manipu- 
lated in a manner that misleads the call recipient about the iden- 
tity of the caller. 

The Commission is deeply concerned about reports that Caller ID 
information is being manipulated for fraudulent or deceptive pur- 
poses and the impact of those practices on the public trust and con- 
fidence in the telecommunications industry. 

We are particularly concerned about how this practice may affect 
consumers as well as public safety and law enforcement commu- 
nities. I think you’re aware of some of the technical means by 
which caller identification travels with the phone call so I won’t go 
into detail and I think that information is in my written testimony. 

The Commission also has addressed caller identification on the 
public switched telephone network in rules that were adopted in 
1995 and generally, those rules require all carriers using Signaling 
System 7 — SS7 — to transmit the calling party number associated 
with an interstate call to interconnecting carriers. This same Com- 
mission rule also requires telemarketers to transmit accurate Call- 
er ID information. 

With the development of the Internet and IP technologies. Caller 
ID spoofing has apparently been made easier — even easier than it 
used to be. Now entities using IP technology can generate false 
calling information and pass it to the PSTN via SS7. 

The Commission’s Enforcement Bureau has been investigating 
this practice since it came to our attention in the summer of 2005, 
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having come to our attention in the context of junk fax spoofing. 
To date, we have initiated investigations on 13 companies engaged 
in the marketing and selling of Caller ID spoofing services to cus- 
tomers. One investigation has resulted in a citation against a tele- 
marketer called Intelligent Alternatives for rule violations includ- 
ing violations of the Caller ID rules under Section 64.1601 of our 
rules. 

We’ve sent formal Letters of Inquiry to these entities and, at the 
same time, served subpoenas on them to compel them to respond 
to our inquiries. In some cases, we followed up with subsequent 
Letters of Inquiry to uncover additional evidence of possible viola- 
tions. 

Importantly, our investigations have revealed that the companies 
that are engaged in these practices are of varying degrees of so- 
phistication that employ disparate methods and technologies to 
provide service to different types of customers. Some of the compa- 
nies, for example, claim that they are involved in legitimate activi- 
ties, providing spoofing services only to customers such as law en- 
forcement officials, private investigators, or to others that are en- 
gaged in the furtherance of debt collection or other similar types 
of activities. 

The companies allow customers to customize, so to speak, the 
services that they select. For example, in some cases, the spoofing 
companies claim that they do not allow the customer to decide the 
particular false number to be displayed on the called parties’ ID 
while others do provide that functionality. This functionality is 
very important because it implicates whether or not a spoofer 
would permit the customer to use 911 as a spoofed number or 
whether the customer could, for example, choose another telephone 
number that might be a government number — and as you suggest. 
Senator Nelson — or the number of other emergency services pro- 
viders. 

The Enforcement Bureau is continuing to gather and analyze in- 
formation about the companies’ practices, their network, busi- 
nesses, and customers, and other relevant matters that will assist 
us in fully understanding the issues and whether violations of the 
Communications Act have, in fact, occurred. 

In addition to our enforcement efforts, the Commission has taken 
steps to prevent those engaged in Caller ID spoofing for deceptive 
reason from successfully accessing the personal information of tele- 
communications customers. In a recent order tightening the Com- 
mission’s Customer Proprietary Network Information rules, we de- 
termined that a carrier providing call history information over the 
phone to a customer must first call that customer back at the tele- 
phone number of record to ensure that the individual calling is, in 
fact, the customer rather than relying on the Caller ID as an au- 
thentication method, thereby eliminating one of the major tools of 
pretexters. 

As we’ve testified previously, the Commission may not have suffi- 
cient authority to fully address this issue of spoofing. Some of the 
entities under investigation, do not appear to be directly regulated 
by the Commission and, in fact, they’ve made this assertion in re- 
sponse to our investigations. Thus, legislation that clarifies the 
Commission’s authority in this area would be helpful. 
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In conclusion, just to reiterate that the intentional manipulation 
of Caller ID information is an issue of importance to the Commis- 
sion, particularly where it is used for fraudulent or deceptive rea- 
sons. We look forward to working with members of the Committee 
and other Members of Congress to ensure that the public main- 
tains its confidence in the telecommunications industry. Thank 
you. 

[The prepared statement of Ms. Monteith follows:] 

Prepared Statement of Kris Anne Monteith, Chief, 

Enforcement Bureau, FCC 

Good morning Chairman Inouye, Vice Chairman Stevens and members of the 
Committee. Thank you for the opportunity to speak about the problem of caller 
identification (Caller ID) spoofing. 

As you know. Caller ID services let customers identify who is calling them before 
they answer a call by displaying the caller’s telephone number or other informa- 
tion — such as a name or business name — on the customer’s equipment before the 
customer picks up the phone. “Caller ID spoofing” refers to a practice in which the 
Caller ID information transmitted with a telephone call is manipulated in a manner 
that misleads the call recipient about the identity of the caller. The use of Internet 
technology to make phone calls has apparently made Caller ID spoofing even easier. 
The Commission is deeply concerned about reports that Caller ID information is 
being manipulated for fraudulent or other deceptive purposes and the impact of 
those practices on the public trust and confidence in the telecommunications indus- 
try. We are particularly concerned about how this practice may affect consumers as 
well as public safety and law enforcement communities. 

In my testimony, I will first provide a brief technical background on Caller ID 
spoofing. Then, I will describe the Commission’s rules addressing Caller ID services 
and the steps the Commission is taking to make sure that providers are fully meet- 
ing their obligations under the Communications Act and the Commission’s rules and 
orders. 

As a technical matter. Caller ID spoofing happens by manipulating the data ele- 
ments that travel with a phone call. Phone calls on the public switched telephone 
network, or PSTN, are routed to their destinations by means of a specialized pro- 
tocol called the Signaling System 7, or SS7. SS7 conveys information associated with 
a call such as the telephone number of the caller. The SS7 information for a call 
is provided by the carrier that the caller uses to place the call. Caller ID then dis- 
plays that caller’s number to the called party. Caller ID spoofing is accomplished 
by manipulating the SS7 information associated with the call. 

The Commission addressed Caller ID on the PSTN in 1995 with rule 64.1601, 
which generally requires all carriers using SS7 to transmit the calling party number 
associated with an interstate call to interconnecting carriers. The same Commission 
rule also requires telemarketers to transmit accurate Caller ID information. 

The development of Internet and IP technologies has made Caller ID spoofing 
easier than it used to be. Now, entities using IP technology can generate false call- 
ing party information and pass it into the PSTN via SS7. Caller ID spoofing can 
potentially threaten our public safety. For example, spoofers can fabricate emer- 
gency calls and cause local law enforcement and public safety agencies to deploy 
their resources needlessly. Caller ID spoofing can potentially threaten consumers. 
For example, spoofing can be used by the unscrupulous to defraud consumers by 
making calls appear as if they are from legitimate businesses or government offices. 

The Commission’s Enforcement Bureau (Bureau) has been investigating the issue 
of Caller ID spoofing since the summer of 2005 when information regarding junk 
fcix spoofing came to our attention. To date, the Bureau has initiated investigations 
of thirteen companies engaged in the marketing and selling of Caller ID spoofing 
services to customers. One investigation resulted in a citation against a tele- 
marketer, Intelligent Alternatives, for rule violations, including violations of the 
Caller ID rules under section 64.1601. We have sent formal Letters of Inquiry and, 
at the same time, served subpoenas to compel responses to our inquiries. In some 
cases, we have issued subsequent Letters of Inquiry to uncover additional evidence 
of possible violations of the Communications Act. 

Our investigations have revealed that the companies engaged in this practice are 
of varying degrees of sophistication that employ disparate methods and technologies 
to provide service to different types of customers. Some of the companies, for exam- 
ple, claim they are providing spoofing services only to customers such as law en- 
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forcement officials or private investigators, or to others engaged in the furtherance 
of debt collection and other similar objectives. The companies also allow customers 
varying amounts of flexibility over the spoofing: some companies claim they do not 
allow customers the ability to customize the false number to be displayed on the 
called party’s Caller ID while others do provide that functionality. This last char- 
acteristic is particularly important when determining whether spoofers permit their 
customers to use “9-1-1” as a spoofed number or whether the customers can spoof 
the numbers of first responders and other emergency services providers. We are con- 
tinuing to seek relevant information to assist us in fully understanding these issues 
and whether violations of the Communications Act or our rules have occurred. 

We also have held meetings with numerous industry representatives, including 
wireline, wireless, and Voice over Internet Protocol (VoIP)-based companies, to de- 
termine the impact of Caller ID spoofing on their consumers and networks. And, we 
have coordinated with state agencies, the Federal Trade Commission and other in- 
terested organizations, such as the National Emergency Number Association, re- 
garding their efforts to address and identify solutions to this problem. The Enforce- 
ment Bureau is committed to continuing to gather and analyze information about 
these companies’ practices, their networks, their businesses, their customers, and 
other germane information. 

In addition to our enforcement efforts, the Commission has taken affirmative 
steps to prevent those engaged in Caller ID spoofing for deceptive reasons from suc- 
cessfully accessing the personal information of telecommunications customers. In a 
recent Order tightening the Commission’s Customer Proprietary Network Informa- 
tion or CPNI rules, the Commission determined that a carrier providing call history 
information over the phone to a customer must call the customer at the account’s 
telephone number of record to provide such information rather than rely on Caller 
ID as an authentication method, thereby eliminating one of the major tools of 
pretexters. 

As the Commission indicated in its testimony before the House of Representatives 
Energy and Commerce Subcommittee on Telecommunications and the Internet last 
year, the Commission may not have sufficient authority to fully address this issue; 
some of these entities do not appear to be directly regulated by the Commission, 
an assertion made by some targets of our investigations. Thus, legislation that clari- 
fies the Commission’s authority in this area would be helpful. 

In conclusion, the intentional manipulation of Caller ID information, especially for 
the purpose of fraud or deception, is a troubling development in the telecommuni- 
cations industry. The Commission looks forward to working with this Committee, 
and other Members of Congress, to ensure the public maintains its confidence in the 
telecommunications industry. Thank you for the opportunity to speak with you 
today. 

Senator Nelson. Thank you, Ms. Monteith. At any time, Senator 
Stevens, since you have to leave early, that you want to go ahead 
and ask questions, feel free. 

Mr. Cerasale? 

STATEMENT OF JERRY CERASALE, 

SENIOR VICE PRESIDENT, GOVERNMENT AFFAIRS, 
DIRECT MARKETING ASSOCIATION, INC. 

Mr. Cerasale. Thank you very much. Senator Nelson, Senator 
Stevens, Senator Klohuchar. It’s a privilege to he here today. The 
Direct Marking Association is a trade organization representing 
multi-channel and interactive marketers who use the mail, the 
phone, the Internet, e-mail, direct response TV, and radio to reach 
consumers and businesses. 

Spoofing of Caller ID harms the consumer. At a minimum, it de- 
ceives the consumer. More so, it can defraud them or even put 
them in harm’s way. Spoofing of ID also harms the company. It’s 
actually stealing the company’s identification. Stealing the ID of 
the company, it ruins the reputation, those actions taken by the 
spoofer are believed by the recipient of the phone call to be the 
marketer itself calling and so it harms both the consumer and the 
business if it’s done. 
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We believe it also undermines the integrity and trust in this 
communication channel, which also is harmful to the economy, to 
government and so forth as we look at communications within the 
United States. The DMA issued guidance about spoofing a long 
time ago. It’s attached to my written testimony. 

Caller ID, properly used, helps the consumer. It let’s them know 
who is calling, what it is and you can channel your phone calls 
yourself and have control over your telephone inbox. So long ago, 
the DMA required its members to present Caller ID, including the 
name of the company and send not fraudulent, truthful — sending 
out that information. 

But to be fully useful. Caller ID has to — marketers have to be 
able to change Caller ID information. If I’m calling you as a tele- 
marketer, Senator Nelson and there’s the number and you want to 
try and get back to me, that phone number will be consistently 
busy because it’s an outgoing telephone number. 

So the idea is, we have to put in a consumer customer service 
number where there are people ready to respond to the call, re- 
spond to the request from the consumer, including even putting 
them on the company’s specific Do Not Call list. 

So there has to be an ability for the direct marketer to alter the 
Caller ID, but not for fraudulent purposes but to actually assist the 
consumer. Also, another problem is the duty of the marketer 
should be to transmit to the carrier the proper Caller ID informa- 
tion. We’ve found many times in instances that in presenting it to 
the consumer’s phone, the information sometimes gets garbled and 
the marketer should not — if they have transmitted the information 
correctly, that should be the duty of the marketer. Now, it’s no 
doubt when it has happened, there have been times when the num- 
ber is altered when it’s received by the consumer so that the local 
area code is placed in front of the number. And of course, the poor 
individual who then has that number that gets all the calls, gets 
angry at the marketer and eventually we find out and try and work 
it out quickly and communications carriers are helpful in trying to 
fix that and so forth; but we want to make sure that the liability 
on the marketer is to transmit to the carrier the proper informa- 
tion. That is the duty of the marketer. 

Looking at S. 704, we support S. 704. We think if you added an 
intent to defraud or cause harm standard, you would protect the 
marketer, those situations that I just mentioned in the sense of 
changing to a customer service number, transmitting the proper 
number to the carrier. It also would cover, we think, some of the 
instances that you mentioned. Senator Nelson, concerning the po- 
lice trying to protect police numbers, not showing them, centers, 
shelters for homeless women, battered women that calling out, you 
don’t want to show the number of that. Put some other number in 
there, a social service number or something so that you can try and 
protect people. 

Those are things, I think, that we need to try and protect in S. 
704, those kinds of changes. We want to go after the spoofers, give 
the FCC all the authority it needs to shut these people down and 
we just need the ability to make Caller ID a valuable service as 
long as we’re not using it to defraud or deceive. Thank you very 
much. 
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[The prepared statement of Mr. Cerasale follows:] 

Prepared Statement of Jerry Cerasale, Senior Vice President, 
Government Affairs, Direct Marketing Association, Inc. 

I. Introduction & Summary 

Good morning Mr. Chairman and Members of the Committee. I am Jerry 
Cerasale, Senior Vice President for Government Affairs of the Direct Marketing As- 
sociation, and I thank you for the opportunity to appear before the Committee as 
it examines S. 704 and the Caller ID spoofing issue in general. 

The Direct Marketing Association, Inc. (“DMA,” www.the-dma.org) is the leading 
global trade association of businesses and nonprofit organizations using and sup- 
porting multichannel direct marketing tools and techniques. DMA advocates indus- 
try standards for responsible marketing, promotes relevance as the key to reaching 
consumers with desirable offers, and provides cutting-edge research, education, and 
networking opportunities to improve results throughout the end-to-end direct mar- 
keting process. Founded in 1917, DMA today represents more than 3,600 companies 
from dozens of vertical industries in the U.S. and 50 other nations, including a ma- 
jority of the Fortune 100 companies, as well as nonprofit organizations. Included are 
cataiogers, financial services, book and magazine publishers, retail stores, industrial 
manufacturers, Internet-based businesses, and a host of other segments, as well as 
the service industries that support them. 

DMA and our members appreciate the Committee’s continued outreach to the 
business community on important issues such as Caller ID spoofing. DMA fully sup- 
ports the efforts of Senators Nelson, McCaskill, and Snowe, and the Committee, to 
enact legislation prohibiting Caller ID spoofing. Spoofing is a malicious practice that 
undermines Caller ID as a useful verification device, and can cause harm to both 
consumers and business. DMA has long recognized Caller ID as an important 
enhancer to two-way communication between people making and receiving calls, es- 
pecially in the context of business and customer relations. Caller ID provides con- 
sumers with choice and control over their telephones. It alerts a consumer as to the 
identity of a caller and allows the consumer to choose whether to answer a call from 
a marketer offering a product or service of interest. 

Caller ID, when used for illegitimate purposes, can have a harmful effect on con- 
sumers and legitimate marketers and other businesses. Bad actors use Caller ID 
spoofing to damage a competitor’s reputation, to gain unauthorized access to a con- 
sumer’s personal information, and to commit illicit practices such as phishing and 
pretexting. The cumulative effect is consumer confusion, possible identity theft, and 
the transfer of ill will to legitimate businesses and marketers. We believe that spoof- 
ing, and, in general, the manipulation of Caller ID for illegitimate purposes, should 
be prohibited. 

Understanding the importance of standards and best practices in fostering con- 
sumer choice, DMA several years ago, working with our members, developed and 
adopted Caller-ID Requirements as part of our Guidelines for Ethical Business Prac- 
tice (“Guidelines”), to specifically discourage illegitimate telemarketing practices 
that threaten to undermine consumer confidence and relations with legitimate mar- 
keters.'^ In 2004, in response to a rise in Caller ID spoofing, DMA issued an advisory 
detailing marketers’ rights and responsibilities when using Caller ID technology.^ 
DMA requires its members, including nonprofits and other groups, to transmit Call- 
er ID information. Specifically, when DMA members make marketing calls, they are 
required to transmit the name of the seller and the telephone number by which a 
called party can call back during normal business hours to ask questions or request 
not to receive future calls. Under our Guidelines, DMA members must not transmit 
a false name or telephone number. 

DMA also supports the importance of accurately disclosing identity and contact 
information in other forms of marketing communications. For example, in the e-mail 
context, our Guidelines detail responsible practices for marketers to disclose accu- 
rate identifying information. The problems caused by inaccurate e-mail headers are 
similar to those in the Caller ID spoofing context. In 2002, in response to illegit- 
imate actors manipulating e-mail message headers, we developed and adopted Com- 


' Caller-ID/Automatic Number Identification Requirements, Article #46, DMA Guidelines for 
Ethical Business Practice, at 23 (attached) (available at http: I ! www.the-dma.orgl guidelines! 
EthicsGuidelines.shtml). 

2 DMA Statement Caller-ID Falsification, September 2004 (attached) (available at http:! i 
www.thedma.org i guidelines ! callerid i shtml). 
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mercial Solicitations Online requirements as part of our Guidelines.® Our members 
are required to clearly disclose the marketer’s identity and street address in e-mail 
solicitations. The identity of the sender of the message must be provided clearly, 
honestly, and not in a misleading manner. The subject lines must accurately convey 
the content of the message, and the header information must be accurate. These re- 
quirements are also part of the CAN-SPAM Act that emerged through this Com- 
mittee. 

II. Legislation Should Include an “Intent To Defraud or Cause Harm” 
Requirement 

As stated at the outset, DMA supports the purpose of S. 704, to prevent the ma- 
nipulation of Caller ID for fraudulent, spoofing purposes. While the practice of 
spoofing to defraud or cause harm to a person is unacceptable, there are legitimate 
reasons for transmitting Caller ID information that is different from the calling par- 
ty’s information that the Committee should ensure are not restricted. Blocking or 
modifying Caller ID information is necessary in several contexts such as safety, pro- 
tecting privileged communications, and in business and customer relations. Busi- 
nesses rely on the practice of modifying Caller ID for such purposes as to facilitate 
a consumer’s request to be placed on a business’s do-not-call list and to properly dis- 
close the identity of the entity on whose behalf a third-party marketer is calling. 
In order to ensure that non-spoofing activities that may involve display of Caller ID 
information that is different from that of the entity making the call are not uninten- 
tionally covered by the legislation, we suggest that the scope of conduct covered by 
the legislation should be narrowed to restrict only such acts committed with “intent 
to defraud or cause harm.” 

Inclusion of such an “intent to defraud or cause harm” standard will serve the 
purpose of explicitly recognizing that the widely adopted business practice of trans- 
mitting a customer service telephone number in place of the calling party’s tele- 
phone number is not restricted. Without such an intent standard, telemarketers 
that substitute a customer service telephone number for call back purposes could 
be covered by the bill. This practice is, in fact, currently required under existing law 
whereby marketers are required to transmit a telephone number through a caller 
identification service by which a called party may place a return call to make in- 
quiries or request that their telephone number be added to the calling party’s do- 
not-call list. Often businesses provide the telephone number of their customer serv- 
ice department to facilitate such requests rather than the number of the calling par- 
ty’s line. Businesses that employ such practices are not seeking to defraud or mis- 
lead customers, but rather transmitting the most relevant information and creating 
processes to efficiently respond to customer requests. 

In addition, we are aware of scenarios where the Caller ID information trans- 
mitted from the telemarketer to a telecommunications carrier is not the same as the 
information provided by the carrier to the call recipient. With a strict liability stand- 
ard, and with no intent standard, telemarketers could be liable for an act of the car- 
rier over which the telemarketer has no control. Thus, the addition of an “intent 
to defraud or cause harm” standard also will ensure that a telemarketer is only re- 
sponsible for accurately providing Caller ID information to the carrier and not for 
incorrect transmission by the carrier. 

Requiring that a calling party provide its exact name and telephone number could 
jeopardize legitimate practices and restrain consumer preferences. Requiring “intent 
to defraud or cause harm” will ensure that bad actors with ill intent are targeted 
by the legislation rather than legitimate practices, customer preferences, and the 
underlying technology used. We believe that tying the act of transmitting mis- 
leading Caller ID information with an intent standard appropriately identifies the 
offending act while ensuring that businesses are not liable for simple mistakes or 
other instances where changing the Caller ID information is appropriate. We note 
that this is the approach that is in the Caller ID spoofing bills that recently passed 
the House of Representatives. 

Thank you for your time and the opportunity to speak before your Committee. I 
look forward to your questions and working with the Committee on this legislation. 


® Commercial Solicitations Online, Article #38, DMA Guidelines for Ethical Business Practice, 
at 20 (attached) (available at http:! j www.the-dma.org ! guidelines i EthicsGuidelines.shtml). 
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Excerpts from the DMA Guidelines for Ethical Business Practice 

Commercial Solicitations Online 

Article #38 

Marketers may send commercial solicitations online under the following cir- 
cumstances: 

• The solicitations are sent to the marketers’ own customers, or 

• Individuals have given their affirmative consent to the marketer to receive so- 
licitations online, or 

• Individuals did not opt out after the marketer has given notice of the oppor- 
tunity to opt out from solicitations online, or 

• The marketer has received assurance from the third party list provider that the 
individuals whose e-mail addresses appear on that list: 

• have already provided affirmative consent to receive solicitations online, or 

• have already received notice of the opportunity to have their e-mail addresses 
removed and have not opted out, and 

• The individual is not on the marketer’s in-house suppression list 

Within each e-mail solicitation, marketers should furnish individuals with a no- 
tice and an Internet-based mechanism they can use to: 

• Request that the marketer not send them future e-mail solicitations and 

• Request that the marketer not rent, sell, or exchange their e-mail addresses for 
online solicitation purposes 

If individuals request that their names be removed from the marketer’s in-house 
online suppression list, then the marketer may not rent, sell, or exchange their e- 
mail addresses with third parties for solicitation purposes. 

The above requests should be honored within 10 business days, and the market- 
er’s opt-out mechanism should be active for at least 30 days from the date of the 
e-mail solicitation. 

Only those marketers that rent, sell, or exchange information need to provide no- 
tice of a mechanism to opt out of information transfer to third-party marketers. 

Marketers should process commercial e-mail lists obtained from third parties 
using DMA’s E-Mail Preference Service suppression file. E-MPS need not be used 
on one’s own customer lists, or when individuals have given affirmative consent to 
the marketer directly. 

Solicitations sent via e-mail should disclose the marketer’s identity and street ad- 
dress. The subject and “from” lines should be clear, honest, and not misleading, and 
the subject line should reflect the actual content of the message so that recipients 
understand that the e-mail is an advertisement. The header information should be 
accurate. A marketer should also provide specific contact information at which the 
individual can obtain service or information. 

Caller-ID/Automatic Number IdentiDcation Requirements 

Article #46 

Wherever the technology is available marketers should: 

• Transmit a telephone number such as the telephone number of the seller, serv- 
ice bureau, or customer service department that the consumer can call back 
during normal business hours to ask questions and/or to request not to receive 
future calls and 

• Transmit the name of the seller or service bureau 

Marketers should not block transmission of caller identification or transmit a false 
name or telephone number. 

Telephone marketers using automatic number identification (ANI) should not 
rent, sell, transfer, or exchange, without customer consent, telephone numbers 
gained from ANI, except where a prior business relationship exists for the sale of 
directly related goods or services. 



11 


DMA Statement Caller-ID Falsification 

Falsely altering Caller-ID information for marketing purposes is not only 
unethical, it is illegal! 

In response to recent news reports about a new Caller ID service that would allow 
subscribers to transmit false Caller-ID information, The DMA has issued this state- 
ment to remind marketers about their rights and responsibilities when using Caller- 
ID technology. 

When calling customers or prospects, it is deceptive and unlawful for a marketer 
to knowingly substitute and transmit a false, or ‘dummy,’ telephone number. Rath- 
er, wherever the technology is available, a marketer must: 

• transmit the name of the seller or service bureau; and 

• transmit an accurate and valid telephone number for the seller, the service bu- 
reau, or respective customer service department. A consumer should be able to 
call back this telephone number during normal business hours to ask questions 
and/or to request not to receive future calls. 

Please note that a marketer MAY transmit a Caller-ID telephone number that is 
DIFFERENT from the number from which the call is coming AS LONG AS the 
number transmitted correctly identifies the name of the seller or service bureau and 
is a valid number that the consumer may call back during normal business hours 
to ask questions and/or to request not to receive future calls. For example, some- 
times it may be necessary to transmit a Caller-ID number for the customer service 
department, instead of the number of the representative who is calling (since the 
representative’s number will likely be busy). In this instance, substituting the cus- 
tomer service department number provides the consumer with a number he/she can 
call back for more information and/or to request to be put on the company’s do-not- 
call list. 

A marketer who intentionally creates and transmits inaccurate or false Caller-ID 
information is violating Federal law — for starters, the Federal Trade Commission 
Act (which outlaws unfair and deceptive trade practices), the Federal Trade Com- 
mission’s Telemarketing Sales Rule, and the Federal Communications Commission’s 
Telephone Consumer Protection Act. 

Moreover, transmitting false Caller-ID information violates the Direct Marketing 
Association’s Guidelines for Ethical Business Practices {Article #44 and Article #51). 
Specifically, Article #44 (Caller-ID/Automatic Number Identification Requirements) 
advises: “Marketers should not block transmission of caller identification or trans- 
mit a false name or telephone number . . .” Article #51 (Laws, Codes, and Regula- 
tions) calls for marketers to abide by state. Federal and local laws governing mar- 
keting practices and business transactions. 

Senator Stevens. Senator, I’m going to have to leave. Could I 
just ask if you’d do two things. First, there is a House bill, H.R. 
251 that has been passed and has been sent to the Senate. Senator 
Kyi has a bill, S. 1654, which has been sent to Judiciary. I think 
there is a criminal side of this and there is also a communications 
side of it. I’d appreciate it very much if you could give us, give to 
our staff, any suggestions you have about modifications of the bill 
with regard to the communications aspect so that we could have 
that information before the mark up next week. 

I do believe we will mark up the bill and get it out next week, 
but I’d hope that we’d be able to make any changes that would be 
necessary to get it to the floor in a manner that would not be con- 
troversial. I think if you have amendments that we can consider 
next week, it would be very helpful. Thank you very much. I hope 
you’ll make me a co-sponsor, Mr. Chairman. 

Senator Nelson. Without objection. 

Senator Stevens. Thank you. 

Senator Nelson. Thank you. Senator. 

Senator Stevens. I also have questions I’ll file for the record. 

Senator Nelson. OK. Thank you, Mr. Cerasale. Ms. Knight? 
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STATEMENT OF ALLISON KNIGHT, STAFF COUNSEL AND 
DIRECTOR, PRIVACY AND HUMAN RIGHTS PROJECT, 
ELECTRONIC PRIVACY INFORMATION CENTER (EPIC) 

Ms. Knight. Good morning. Senator Nelson, Members of the 
Committee, thank you for the opportunity to testify today on Caller 
ID spoofing and the Truth in Caller ID Act of 2007, S. 704. My 
name is Allison Knight and I’m Staff Counsel and Director of the 
Privacy and Human Rights Project at the Electronic Privacy Infor- 
mation Center. 

I’d like to discuss two separate and important privacy interests 
related to the issue of Caller ID spoofing and the first is the right 
for call recipients to be free from pretexting and other fraud that 
can lead to the loss of their privacy and the threats of stalking, 
identity theft and harassment and we’ve heard from the other pan- 
elists on this issue. 

The second is the rights of callers to limit the disclosure of their 
phone numbers in order to protect their privacy and in some cases, 
their safety. The Truth in Caller ID Act of 2007, S. 704, as cur- 
rently drafted, does not adequately protect both of these interests. 
EPIC recommends that any ban on Caller ID spoofing include an 
intent requirement so that spoofing is only prohibited where it is 
clear that the person who does not provide identifying information 
intends to defraud or to cause harm. 

EPIC recommended the inclusion of an intent requirement in tes- 
timony on a similar bill introduced in the House last year and this 
intent requirement was incorporated into the version of the bill 
that recently passed in the House that was just referred to, H.R. 
251. As Mark Rotenburg, Executive Director of EPIC stated, “an 
intent requirement preserves the privacy rights of callers and per- 
mits legitimate uses of spoofing while outlawing fraud and harass- 
ment assisted by the technology.” 

We also have concerns about the provision in the Senate bill that 
permits law enforcement agencies to possibly misrepresent their 
identities in the context of telecommunications services. 

Before Caller ID services were offered, telephone customers gen- 
erally had the ability to control the circumstances under which 
their phone numbers were disclosed to other people. Many individ- 
uals have legitimate reasons to report a different number than the 
one presented on Caller ID. For example, a person may wish to 
keep his or her direct line private when making calls from within 
an organization. Similarly, an individual with multiple communica- 
tions devices, such as a landline and a cell phone and a wireless 
handheld device, may want to route all returned calls to one device 
or a number. 

Now, in some circumstances, disclosure of a person’s phone num- 
ber may also put his or safety at risk. Domestic violence survivors, 
shelters and other safe homes need to preserve the confidentiality 
of their phone numbers. They may need to contact abusers without 
exposing their location in order to arrange custody or other legiti- 
mate matters. They may also need to contact other third parties, 
such as businesses that have permissive privacy policies and may 
share collected phone numbers with lists or data brokers. In all of 
these situations, preserving anonymity is necessary for the caller’s 
safety. 
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Caller ID blocking may seem like a viable means for allowing 
callers to protect their anonymity while not misleading recipients, 
however Caller ID blocking is not a complete solution because a 
caller can be identified through other means, first of all, such as 
the Automatic Number Identification System, which was developed 
for emergency services. Also, some recipients prevent blocked ID 
calls and indications are that the number of individuals doing this 
is growing. So in the case of a domestic violence survivor, attempt- 
ing to safely reach a required phone number, an individual would 
have to use spoofing for the innocent purpose of preserving the con- 
fidentiality of his or her number. 

We can’t ignore the privacy interests of those who decline to ac- 
cept calls from unknown numbers. If an individual has been habit- 
ually harassed by phone calls from a Caller ID-blocked number, we 
should not permit the harasser to use spoofing as a means to cir- 
cumvent the individual’s screening and I believe this is the pur- 
pose, the reason that this bill was introduced. 

Caller ID spoofing can create privacy risks. Last year, EPIC 
brought to Congress’s attention, the problem of pretexting con- 
sumers’ phone records. Pretexting is a technique by which a bad 
actor can obtain an individual’s personal information by imper- 
sonating a trusted entity. For these reasons, the practice of spoof- 
ing for the purpose of fraud or for harm should be curtailed. Pre- 
venting spoofing for harmful reasons would hold illegitimate spoof- 
ers accountable. 

Spoofing Caller ID numbers can create a real risk to individuals 
who might be defrauded or harmed by illegitimate uses of the tech- 
nology, at the same time, it’s important not to punish those who 
may have a legitimate reason to conceal their actual phone num- 
bers. The inclusion of an intent requirement in the Senate bill 
would focus the punishment on harmful and fraudulent uses of 
Caller ID spoofing while preserving legitimate uses of the tech- 
nique. 

In addition, an intent requirement would render specific exemp- 
tions, such as for law enforcement unnecessary as a legitimate law 
enforcement activity that employs spoofing would be protected by 
the requirement to show an intent to defraud or cause harm. 

I’d be happy to answer any questions you have. Thank you. 

[The prepared statement of Ms. Knight follows:] 

Prepared Statement of Allison Knight, Staff Counsel and Director, Privacy 

AND Human Rights Project, Electronic Privacy Information Center (EPIC) 

Chairman Inouye, Vice Chairman Stevens, and members of the Committee, thank 
you for the opportunity to testify today on Caller ID spoofing and the Truth in Call- 
er ID Act of 2007, S. 704. My name is Allison Knight and I am Staff Counsel and 
Director of the Privacy and Human Rights Project at the Electronic Privacy Infor- 
mation Center. EPIC is a non-partisan research organization based in Washington, 
D.C. that seeks to focus public attention on emerging civil liberties issues and to 
protect privacy, the First Amendment, and Constitutional values. 

Two separate and important privacy interests meet in the issue of Caller ID spoof- 
ing. First, there is the right of callers to limit the disclosure of their phone numbers 
in order to protect their privacy, and in some cases, their safety. Second, there is 
the right for call recipients to be free from pretexting and other fraud that can lead 
to the loss of their privacy, and the threats of stalking, identity theft, and harass- 
ment. 

The Truth in Caller ID Act of 2007, S. 704, as currently drafted does not ade- 
quately protect both interests. EPIC recommends that any ban on Caller ID spoofing 
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include an intent requirement, so that spoofing is only prohibited where it is clear 
that the person who does not provide identif3dng information “intends to defraud or 
cause harm.” EPIC recommended the inclusion of an intent requirement in testi- 
mony on a similar bill introduced in the House last year,i and this intent require- 
ment was incorporated into the version of bill that recently passed in the House.^ 
As Marc Rotenberg, Executive Director of EPIC stated, “an intent requirement pre- 
serves the privacy rights of callers and permits legitimate uses of spoofing, while 
outlawing fraud and harassment assisted by the technology.”^ We also have con- 
cerns about the provision in the Senate bill that permits law enforcement agencies 
to possibly misrepresent their identities in the context of telecommunications serv- 
ices. 

Telephone Customers Have Legitimate Reasons to Withhold Their Phone 
Numbers 

The introduction of Caller ID services and the associated Automatic Number Iden- 
tification (AND created new risks to privacy. Before these services were offered, tele- 
phone customers generally had the ability to control the circumstances under which 
their phone numbers were disclosed to others. In many cases, there was little need 
for a telephone customer to disclose a personal phone number if, for example, a per- 
son was calling a business to inquire about the cost or availability of a product or 
wanted information from a government agency. In other cases, there was a genuine 
concern that a person’s safety might be at risk. For example, women at shelters who 
were trying to reach their children were very concerned that an abusive spouse not 
be able to find their location.’^ 

In the context of the Internet and the offering of voice services over Internet Pro- 
tocol (VoIP), there are additional concerns about the circumstances under which a 
person may be required to disclose their identity. The Supreme Court has repeat- 
edly made clear that the right to be anonymous is protected by the First Amend- 
ment and also that the Internet is entitled to a high level of First Amendment pro- 
tection.® 

Many individuals have legitimate reasons to report a different number than the 
one presented on Caller ID. For example, a person may wish to keep her direct line 
private when making calls from within an organization. Such an arrangement legiti- 
mately gives call recipients a number to which they can return a call, but prevents 
an individual person’s phone from being inundated with calls that should be routed 
elsewhere. 

In addition to threatening a person’s rights to privacy and to freedom of speech, 
in some circumstances disclosure of a person’s phone number may also put his or 
her safety at risk. For example, domestic violence survivors, shelters, and other safe 
homes need to preserve the confidentiality of their phone numbers. They may need 
to contact abusers without exposing their location, in order to arrange custody or 
other legitimate matters. They may need to contact businesses the abuser is ac- 
quainted with, and that may share survivor information with the abuser. They may 
also need to contact other third parties, such as businesses that have permissive pri- 
vacy policies, and thus share collected telephone numbers with list or data brokers. 
In all of these situations, preserving anon3miity is necessary for safety.® 


iThe Truth in Caller ID Act of 2006, H.R. 5126. 

2The intent requirement was also included in the Truth in Caller ID Act of 2007, H.R. 251. 
EPIC testified on this House bill on February 28, 2007, in support of the intent requirement. 
The Truth in Caller ID Act of 2007, H.R. 251 passed the House on June 12, 2007, and was re- 
ceived into the Senate and referred to the Committee on Commerce, Science, and Transportation 
on June 13, 2007. 

^H.R. 5126, the Truth in Caller ID Act of 2006: Before the Subeomm. on Telecommunications 
and the Internet of the H. Comm, on Energy and Commerce, 109th Cong. (2006) (statement of 
Marc Rotenberg, President and Executive Director, Electronic Privacy Information Center). See 
also, H.R. 251, the Truth in Caller ID Act of 2007: Before the Subeomm. on Telecommunications 
and the Internet of the H. Comm, on Energy and Commerce, 110th Cong. (2007) (statement of 
Allison Knight, Director, Privacy and Human Rights Project, Electronic Privacy Information 
Center). 

'^Letter from National Network to End Domestic Violence to the House Committee on Energy 
and Commerce (May 16, 2006). 

® Watchtoiver Bible & Tract Society v. Village of Stratton, 536 U.S. 150 (2002), McIntyre v. 
Ohio Elections Commission, 514 U.S. 334 (1995), and Talley v. California, 362 U.S. 60 (1960); 
ACLUv. Reno, 521 U.S. 844 (1997). 

^Domestic Violence and Privacy, Electronic Privacy Information Center http:/ lwww.epic.org/ 
privacy /dv / . 
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Caller ID Blocking Does Not Adequately Protect Privacy Interests 

Caller ID blocking may seem like a viable means for allowing callers to protect 
their anonjmiity while not misleading recipients. However, Caller ID blocking is not 
a complete solution. One reason for this is that Caller ID is not the only way that 
a caller can be identified. Another system, known as Automatic Number Identifica- 
tion, or ANI, will still disclose a caller’s identity in many situations, regardless of 
whether or not the caller used call blocking. This means that many businesses, 
emergency service providers, and anyone with a toll-free number can reliably gain 
the phone number of a caller, even if Caller ID is blocked. Spoofing services can pro- 
tect the anonymity of a caller’s ANI data when calling toll-free numbers and those 
entities that use ANI identification. 

Some recipients prevent blocked ID calls, and indications are that the number of 
individuals doing this is growing. In the case of a domestic violence survivor at- 
tempting to safely reach a required phone number, an individual would have to use 
spoofing for the innocent purpose of preserving the confidentiality of his or her num- 
ber. 

We also cannot ignore the privacy interests of those who decline to accept calls 
from unknown numbers. If an individual has been habitually harassed by calls from 
a caller-blocked number, we should not permit the harasser to use spoofing as a 
means to circumvent the individual’s screening. At the same time, it is clear that 
there could be prosecution for harassment whether or not additional prohibition on 
spoofing were enacted.'^ 

Spoofing Can Create Privacy Risks 

This is not to say that Caller ID spoofing is an unqualified good — far from it. Last 
year, EPIC brought to Congress’s attention the problem of pretexting consumers’ 
phone records.® Pretexting is a technique by which a bad actor can obtain an indi- 
vidual’s personal information by impersonating a trusted entity. Pretexters have 
spoofed the telephone numbers of courthouses, in order to harass people for sup- 
posedly missing jury duty, threatening fines or arrest unless they turn over Social 
Security Numbers or other personal information.® Rob Douglas of PrivacyToday.com, 
with whom EPIC has worked on the pretexting issue, noted how fraudsters would 
use spoofing services in order to fool customers into thinking that fraudulent calls 
were coming from trusted sources, i® 

For these reasons, illegitimate spoofing activities should be curtailed. Law en- 
forcement and telephone companies can retrace these calls to the originating serv- 
ice. A spoofed number is not completely anonymous and without accountability. 
Preventing spoofing for harmful reasons will hold illegitimate spoofers accountable. 

Intent Requirement 

The inclusion of an intent requirement in the Senate bill would focus the punish- 
ment on harmful and fraudulent uses of Caller ID spoofing while preserving legiti- 
mate uses of the technique. In addition, an intent requirement would render specific 
exemptions for law enforcement unnecessary, as legitimate law enforcement activity 
that employs spoofing would be protected by the requirement to show intent to de- 
fraud or cause harm. 

Significance of NSA Surveillance Program for Privacy of Call Records 

Mr. Chairman, I would also like to bring to the Committee’s attention our concern 
that the National Security Agency may have constructed a massive database of tele- 
phone toll records of American consumers. Last year, EPIC filed a complaint with 
the Federal Communications Commission in which we alleged that Section 222 of 
the Communications Act, which protects the privacy of customer record information, 


’’See 47 U.S.C. §223; 47 U.S.C. §227. 

^Protecting Consumers’ Phone Records: Before the Subcomm. on Consumer Affairs, Product 
Safety, and Insurance of the S. Comm, on Commerce, Science, and Transportation, 109th Cong. 
(2006) (statement of Marc Rotenberg, President and Executive Director, Electronic Privacy Infor- 
mation Center), http:/ lwww.epic.org/priuacy tieilsencomtest2806.html; Phone Records for Sale: 
Why Aren’t Phone Records Safe From Pretexting/: Before the H. Comm, on Energy and Com- 
merce, 109th Cong. (2006) (statement of Marc Rotenberg, President and Executive Director, 

Electronic Privacy Information Center) http://www.epic.org/privacy/iei/pretext testimony.pdf. 

®Sid Eirchmeyer, Scam Alert: Courthouse Con, AARPBulletin, May 2006, http:// 

www.aarp.org/huUetin/consumer/courthouse con.html. 

^^Phone Records for Sale: Why Aren’t Phone Records Safe From Pretexting/: Before the H. 
Comm, on Energy and Commerce, 109th Cong. (2006) (statement of Robert Douglas, CEO, 
PrivacyToday.com), http:/ / www.privacytoday.com / HC020106.htm. 

u Peter Svenson, Caller ID Spoofing Becomes All Too Easy, USA Today, Mar. 1, 2006, http:/ / 
WWW. usatoday.com / tech / news / 2006-03-01 -caller -id x.htm. 
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might have heen violated. We urged the Commission to undertake an investigation 
of this issue. In light of the ongoing controversy about the possibility that Federal 
privacy laws were violated, the need to pursue this investigation is clear. 

We respectfully ask Members of this Committee to support EPIC’s recommenda- 
tion that the FCC undertake an investigation of the possibly improper disclosure of 
telephone toll records by the telephone companies that are subject to the privacy 
obligations contained in the Communications Act. If the Communications Act was 
violated, that should be of great concern to the Committee. 

Conclusion 

Spoofing Caller ID numbers can create a real risk to individuals who might be 
defrauded or harmed by illegitimate uses of this technology. At the same time, it 
is important not to punish those who may have a legitimate reason to conceal their 
actual telephone numbers. The inclusion of an intent requirement in the Truth in 
Caller ID Act of 2007 would significantly improve the bill by distinguishing between 
appropriate and inappropriate Caller ID spoofing. 

I will be happy to answer any questions you might have at this time. 

Senator Nelson. Thank you, Ms. Knight. Mr. Jones? 

STATEMENT OF HON. RON JONES, COMMISSIONER, 
TENNESSEE REGULATORY AUTHORITY; CHAIRMAN, 

CONSUMER AFFAIRS COMMITTEE, NATIONAL ASSOCIATION 
OF REGULATORY UTILITY COMMISSIONERS 

Mr. Jones. Thank you, Senator Nelson and memhers of the Com- 
mittee. NARUC represents the state public utility commissions, the 
PUCs in all 50 states, the District of Columbia and U.S. territories 
with jurisdiction over telecommunications, electricity, natural gas, 
water and other utilities and in this capacity, the PUCs are on the 
frontline of consumer protection in these areas and are often the 
first to learn of emerging consumer concerns. 

NARUC is pleased to be here in support of the enactment of Call- 
er ID spoofing legislation. In fact, NARUC considered and passed 
a resolution that was adopted at our summer meeting in 2006. As 
has been mentioned here. Caller ID spoofing harms consumers in 
the areas of identity theft, credit card fraud, public safety, 
endangerment, law enforcement interference and other areas. 

But more specifically of concern to NARUC, NARUC believes 
that government at all levels must be able to identify and address 
new and novel threats in a timely fashion to ensure the safety of 
consumers. Allowing the practice of Caller ID spoofing to continue 
may reduce consumer trust in many of the public, commercial, fi- 
nancial and political institutions that are relied upon by American 
consumers. 

NARUC is pleased with the inclusion of language in S. 704, ac- 
knowledging the key role state officials play in protecting con- 
sumers through enforcement of state laws that are consistent with 
Federal rules. NARUC’s one suggestion for change in the bill would 
be to strike the section limiting state action while a Federal en- 
forcement action or proceeding is pending. Federal and state agen- 
cies can mutually benefit from revelations gleaned from concurrent 
investigation of violations of their respective laws and we see a 
great benefit in not taking cops off the beat, so to speak. 

Consumer protection is and has been for a long time, a core com- 
petency of state commissions. States should not be encumbered 
from investigation and enforcement of violations of state law. 


EPIC Complaint to the Federal Communications Commission (May 16, 2006). 
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Caller ID spoofing is a key tool in identity theft efforts by crimi- 
nals. The Federal Trade Commission reports that 10 million indi- 
viduals are victims of identity theft each year and identity theft is 
the number one consumer complaint. Passage of the Truth in Call- 
er ID Act of 2007 will be a huge step forward in reducing the prob- 
lem of identity theft. NARUC believes it will remove a major weap- 
on that is Caller ID spoofing from the arsenal of criminals. 

Senator Nelson and members of the Committee, NARUC and its 
members are committed to working with you to protect consumers 
and we urge your swift passage of S. 704 to end the practice of 
Caller ID spoofing and we certainly thank you for inviting NARUC 
to testify before the Committee and I’d be happy to answer any 
questions. 

[The prepared statement of Mr. Jones follows:] 

Prepared Statement of Hon. Ron Jones, Commissioner, Tennessee 

Regulatory Authority; Chairman, Consumer Affairs Committee, National 

Association of Regulatory Utility Commissioners 

Mr. Chairman, Vice Chairman Stevens, and Members of the Committee, thank 
you for the opportunity to testify today on S. 704, the “Truth in Caller ID Act of 
2007.” 

I am Ron Jones, Commissioner with the Tennessee Regulatory Authority and a 
member of the National Association of Regulatory Utility Commissioners (NARUC). 
I serve as Chairman of NARUC’s Committee on Consumer Affairs. NARUC rep- 
resents State public utility commissions (PUCs) in all 50 States, the District of Co- 
lumbia and U.S. territories with jurisdiction over telecommunications, electricity, 
natural gas, water and other utilities. In this capacity, PUCs are on the frontline 
of consumer protection in these areas and are often the first to learn of emerging 
consumer concerns. 

We commend you, Co-Chairman Stevens, the sponsors of this legislation Senators 
Nelson and Snowe, your staffs and other committee members, for addressing the 
issue of Caller ID fraud, otherwise known as Caller ID spoofing. Caller ID spoofing 
is an issue of growing concern and one of the many tools criminals can use to per- 
petrate fraud and steal the identities of hard-working, law-abiding Americans. 

I am pleased to be here today to present NARUC’s support for enactment of Caller 
ID spoofing legislation that would prohibit the intentional falsification of the name 
or number that appears on a customer’s caller identification (ID) display. A resolu- 
tion to this end was adopted at the NARUC Summer Meeting in 2006, which I have 
submitted for the record with my testimony. The resolution was adopted in response 
to growing consumer complaints concerning the practice of Caller ID spoofing and 
notes the important role state PUCs play in policing such activities. 

The telecommunications industry has experienced a decade of unprecedented tech- 
nological innovation bringing consumers an array of new communications devices 
and services. Unfortunately, with new technology often come new risks and in- 
creased opportunities criminals can exploit for their own nefarious purposes. 

Previously, special equipment and knowledge was necessary to fake Caller ID in- 
formation. However, the rise of new multifunctional, user friendly, Internet tech- 
nologies and Voice over Internet Protocol (VoIP) has put spoofing within easy reach 
of scammers. All one has to do is go to a website, pay a small fee — often as low 
as $10 — type in the number you’d like to call then input the name and number that 
you would like to be displayed on the call recipients Caller ID. It is as easy as that. 

How is Caller ID spoofing being used and how is it harming consumers? There 
are several areas in which this technology is being used to harm consumers, includ- 
ing but certainly not limited to: 

• Identity theft: Caller ID fraud is a key tool in pretexting which is the practice 
of obtaining personal information under false pretenses 

• Criminals can falsify the home number of consumers to activate or make pur- 
chases on stolen creit cards 

• Emergency calls to 911 call centers can be fabricated diverting public safety re- 
sources away from real emergencies 

• Terrorists could use it to mask their true location hampering law enforcement 
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• An ex-spouse could use it to harass a former wife or husband who has blocked 
calls from their phone 

Each of these examples is alone a legitimate reason to prohibit the practice of 
Caller ID spoofing. Taken together they provide overwhelming evidence of the need 
for this legislation. In our increasingly technological age, government at all levels 
must be able to identify and address new and novel threats in a timely fashion to 
ensure the safety of consumers. Allowing the practice of Caller ID spoofing to con- 
tinue may reduce consumer trust in many of the public, commercial, financial and 
political institutions that are relied upon by American consumers. 

The full extent of Caller ID spoofing is difficult to ascertain. By its very nature 
the goal is to disguise the true identity of the perpetrator and their motives. In 
many cases a consumer may not even know they were a victim of Caller ID spoof- 
ing. States, like the Federal Government, are becoming more aware of this problem 
and are looking to prohibit the practice. 

In my home State of Tennessee, our Senate approved Caller ID spoofing legisla- 
tion but it failed to pass the House. Although my state does not have a specific Call- 
er ID spoofing law, we are collecting information and learning the extent of such 
fraud through our oversight of the State Do Not Call (DNC) Registry. 

When a complaint regarding a DNC Registry violation is received from a con- 
sumer, the Authority initiates an investigation. If it is subsequently determined that 
the Caller ID information utilized in the violation was falsified, it is noted in the 
record. A review of 2007 Do Not Call violations found forty-two complaints that the 
Regulatory Authority was not able to fully investigate because the originator of the 
call could not be determined or contacted. This happened because the number pro- 
vided to us by the Do Not Call complainant was a spoofed number and could not 
be traced back to the caller despite agency subpoenas for phone records of the com- 
plainant in an effort to determine the identity of the caller. 

The forty-two complaints represent about 14 percent of the total Do Not Call com- 
plaints received by the Tennessee Regulatory Authority since the first of this year. 
While this may not sound like a large percentage, it is my belief that this number 
is not representative of the true scope of this problem. Regardless, each of these 
identified forty-two instances of Caller ID fraud is a potential crime and therefore 
should not be condoned. 

To elaborate on the breadth of this problem, let me share with you an example 
of Caller ID fraud investigated by my colleagues in Nebraska. The Nebraska Public 
Service Commission investigated a slew of pre-recorded, automatically dialed calls 
on the eve of the November 2006 election. The Commission received several com- 
plaints about the politically motivated calls in the days before the election. Upon 
investigation, the Commission learned the numbers that appeared on the Caller ID 
were fraudulent and in most cases they were phone numbers that were unassigned. 
Even with the help of the phone companies they were unable to determine the ac- 
tual source of the calls. 

NARUC is pleased with the inclusion of language in S. 704 acknowledging the key 
role State officials play in protecting consumers through enforcement of State laws 
that are consistent with Federal rules. NARUC’s one suggestion for change in the 
bill would be to strike the section limiting State action while a Federal enforcement 
action or proceeding is pending. Federal and State agencies can mutually benefit 
from revelations gleaned from concurrent investigation of violations of their respec- 
tive laws. Consumer protection is a core-competency of State commissions; States 
should not be encumbered from investigation and enforcement of violations of State 
law. 

As I previously stated. Caller ID spoofing is a key tool in identity theft efforts by 
criminals. The Federal Trade Commission reports that 10 million individuals are 
victims of identity theft each year and identity theft is the number one consumer 
complaint. Passage of the Truth in Caller ID Act of 2007 will be a big step forward 
in reducing the problem of identity theft. It will remove a major weapon. Caller ID 
spoofing, from the arsenal of criminals. 

Mr. Chairman, members of the Committee, NARUC and its members are com- 
mitted to working with you to protect consumers. We urge your swift passage of S. 
704 to end this practice. Thank you for inviting me to testify before you and I would 
be happy to answer any questions. 
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Resolution* Supporting Federal Legislation To Combat Caller 
Identification Spoofing 

Whereas, Congress is considering legislation to prohibit the intentional falsifica- 
tion of the name or number that appears on a consumer’s caller identification (ID) 
display, commonly referred to as “Caller ID spoofing”; and 

Whereas, The Truth in Caller ID Act of 2006, H.R. 5126, would make it unlawful 
for a person, in connection with any telecommunications service or VoIP service, to 
cause any caller identification service to transmit misleading or inaccurate caller 
identification information with the intent to defraud or cause harm; and 

Whereas, The use of Internet technology to make telephone calls has made Caller 
ID spoofing easier; and 

Whereas, Caller ID spoofing may be used for fraudulent or deceptive purposes 
which could harm consumers and lessen consumers’ trust in the telecommunications 
industry; and 

Whereas, Caller ID spoofing may also threaten public safety by fabricating emer- 
gency calls and thereby diverting public safety resources away from real emer- 
gencies; and 

Whereas, The Federal Communications Commission (FCC) is attempting to ad- 
dress this problem through enforcement actions and coordination with the Federal 
Trade Commission (FTC); and 

Whereas, The National Association of Regulatory Commissioners (NARUC) and its 
member states have consistently supported and encouraged consumer protection 
and safety issues; now therefore be it 

Resolved, That the Board of Directors of the National Association of Regulatory 
Commissioners (NARUC), convened in its 2006 Summer Meetings in San Francisco, 
California, expresses its support for Federal legislation that would make it unlawful 
for a person to transmit misleading or inaccurate caller identification information 
with the intent to defraud or cause harm; and be it further 

Resolved, That NARUC is committed to working with Congress, the FCC, the 
FTC, and the industry on a comprehensive approach to this issue in order to edu- 
cate and protect consumers from Caller ID spoofing. 

Senator Nelson. Thank all of you very much. Senator Klo- 
buchar? 


STATEMENT OF HON. AMY KLOBUCHAR, 

U.S. SENATOR FROM MINNESOTA 

Senator Klobuchar. Thank you, Mr. Chairman. Thank you. I’m 
sorry I missed the opening statements. I had another meeting and 
I’m the new Senator from Minnesota and I have a background that 
is interesting for what we’re talking about today because I prac- 
ticed in the telecommunications area for 13 years and worked with 
NARUC rather extensively, Mr. Jones, and then also was a pros- 
ecutor for 8 years and so I dealt with these issues. In fact, my 
claim to fame is that I got a law passed in Minnesota banning 
Internet phishing but I still got elected somehow. 

Anyway, my focus here is on trying to solve this in a way that 
works. I’ve encountered these things before where if you do things 
too broadly, you can make mistakes but at the same time. I’ve seen 
the consequences of these kinds of fraud and crime, especially in 
the criminal areas where perpetrators might try to pretend they 
are someone else when they’re calling. And at the same time, I was 
very interested in what you were saying, Ms. Knight, because when 
I was a prosecutor, we obviously had blocked phones and I know 
exactly what you mean, that more and more people don’t accept 
blocked phone calls so when you have victims of domestic abuse or 
people at shelters, there must be a way to get around this. So I’m 


*Sponsored by the Committees on Telecommunications and Consumer Affairs. Adopted by the 
NARUC Board of Directors August 2, 2006 
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very interested and I was talking to Senator Nelson and his staff 
about some kind of slight change to this so that we make sure that 
those things wouldn’t be banned or get someone in trouble for 
doing that for what is really a good reason. 

So my questions are, well first of all, of you, Mr. Jones about the 
idea of striking the section that talks about allowing state action 
to continue. Are there state actions that are ongoing in this area 
or do you have examples from around the country where people are 
looking into this? 

Mr. Jones. Well, Senator, I’m not aware of current state actions. 
I know in the State of Tennessee, when we have violations of the 
Do Not Call Registry and we seek to determine the manner of that 
violation, often times that we determine that that number is a 
spoof call. But more importantly, what we seek to try to preserve 
is the ability for states, when they do take action or decide to take 
action, to pursue Caller ID spoofing and as such, consider legisla- 
tion that they are able to do so and they are not encumbered by 
a prohibition in Federal law from moving forward. 

Senator Klobuchar. Then, Ms. Monteith, did I say your name 
correctly? It’s easier than mine. But this is based on your prepared 
testimony about how the FCC has met with some of the companies, 
wireless and wireline and Voice over Internet Protocol companies, 
about the Caller ID spoofing issue. Could you talk a little bit about 
what they said in terms of any work that is being done to try to 
address the issue coming from the private sector? 

Ms. Monteith. Our meetings with service providers were aimed 
at both understanding potentially how this works within the tele- 
communications network and also discussing with them whether or 
not they were getting complaints from their customers about spoof- 
ing activities. We did learn how this happens in the network, and 
as I mentioned, there are a variety of different ways in which a 
number can be spoofed. 

In terms of complaints, we get complaints and I think some of 
the telecom carriers have gotten complaints, and they try to re- 
dress them in a variety of ways. Sometimes, as I think the Com- 
mittee is aware, we’ve found it is difficult to determine where the 
spoofing is coming from. Sometimes it is couched as telemarketing. 
Sometimes it is harassment types of complaints and it is often 
times difficult to identify who is at the bottom of it. 

I’m not sure I’ve addressed your question. I’m sorry. Senator. 

Senator Klobuchar. No, and I can talk to some of them, too. 
You know, sometimes there can be technological answers to these 
things because it is often like looking for a needle in a haystack, 
as you mentioned, to try to find the perpetrator and beyond that, 
I remember we dealt with this with the phishing issue. Often times 
people are victims and they don’t know it. You didn’t hear a com- 
plaint because there is some marketer and maybe they didn’t re- 
spond positively so we never knew it happened. But I just won- 
dered if you have seen that happening, if you think there is a lot 
more of this going on than we know of. 

Ms. Monteith. That may be the case. In just looking at the com- 
plaint numbers that the Commission has received, we really have 
not seen what we would characterize as a large number of con- 
sumer complaints. For example, in 2005, we received two dozen 
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complaints. In 2006, roughly double that, about 60 complaints, and 
so far this year, around 30 complaints. Those are not large num- 
bers of complaints when you’re talking about consumers nationwide 
having the ability to file complaints with the FCC. 

Senator Klobuchar. Although some people might complain to 
the Attorney General’s Offices in their state. 

Ms. Monteith. Correct. 

Senator Klobuchar. I mean, I just remember with the phishing 
issue, it was clearly going on. The banks were really upset about 
it. Their names were being used fraudulently on these e-mails and 
it was going on everywhere and when someone was a victim, it was 
bad because they would maybe lose hundreds of thousands of dol- 
lars. But there were many victims that didn’t know they were vic- 
tims and I’m wondering if that’s a little bit of what’s going on here. 
I don’t think I’d remember if I see some marketing firm on a Caller 
ID. I might not answer the phone and never even know it hap- 
pened. So do you think it’s possible that there is more of it going 
on that isn’t reflected in the complaints? 

Ms. Monteith. Yes, I do think that that’s possible. 

Senator Klobuchar. All right, good. I just wondered, Ms. 
Knight, if you could just talk a little bit more about the victim 
angle here and the privacy angle in terms of making sure as we 
look at how we could couch some language on the intent and make 
it narrow enough that it doesn’t preclude prosecution of these 
crimes. Sometimes it’s hard to prove intent but if you have some- 
one who is stealing money or something, it makes it a lot easier. 
But could you give me your thoughts on that? 

Ms. Knight. Sure. The language that EPIC has recommended 
would be including an intent to defraud or to cause harm. Another 
reason that we chose those two terms was that first of all, fraud 
would generally deal with commercial violations and would imply 
monetary damages and then second, harm would appropriately 
widen the intent requirement beyond strictly fraudulent activity to 
capture threats to physical safety associated with activities such 
stalking and domestic violence that I spoke about earlier. 

Senator Klobuchar. OK, thank you. Mr. Cerasale, you’re the 
only one I didn’t ask a question of, so I guess my last question will 
be for you. I’d asked Ms. Monteith about any efforts in the private 
sector of looking at this issue and I wondered if you knew of any 
from a technological standpoint? 

Mr. Cerasale. Well, from a technological standpoint, our mem- 
bers — as we said, most of them do, if they are telemarketers, alter 
the Caller ID number that is transmitted to a customer service 
number where someone will answer. They keep a record of watch- 
ing what kind of problems they find, problems in the final trans- 
mission of the Caller ID information to the recipient. Sometimes 
that can be garbled and they work with the carriers to try and fix 
that. They have not, at this point — there has not been, from a 
straight marketer’s point of view, a great clamor to the DMA that 
this is a major problem. We are starting to hear it some from 
banks and so forth, similar to phishing. I think you have to look 
at this as telephone phishing and it starts with the banks. “Please 
give me your number. We have a problem with our computer sys- 
tem and I need this.” 
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So those kinds of things are what we’re starting to see and they 
tend to be a spoofing of someone with whom you have a true, 
strong customer relationship. With so many phone numbers on a 
National Do Not Call Registry, there are many consumers who do 
not, if they are on the registry and someone is spoofing, they don’t 
care about that. They’re just going to call. Many of those consumers 
don’t answer the phone. So then that spoofing may occur, as you 
spoke about and it’s not reported, because I don’t respond, because 
I’m not supposed to be receiving telemarketing phone calls, because 
I’m on the list. But if I receive something from my bank or some- 
thing where I have a really close relationship, those are the ones 
that will be answered and we’re starting to hear some noise from 
banks on that. And it looks like it may be that banks and similar 
types of financial institutions are going to do the same thing 
they’ve done with phishing — we will never call you and ask you di- 
rectly for your account numbers, just like we’ll never send you an 
e-mail asking for your account numbers. And I think that’s the way 
that we see beginning, from a marketers’ standpoint, of trying to 
combat the spoofing of a financial institution to try and defraud. 

Senator Klobuchar. Well, thank you. Now, I would point out, 
when we embarked on this phishing adventure a few years ago in 
our state, I just noticed yesterday — I was reading the Star and 
Tribune in Minneapolis and they had just convicted someone or 
charged someone. So I think that I wanted to thank Senator Nel- 
son for being out front on this with Senator Snowe. 

I think just because we’ve seen a creeping number of complaints 
going up is all the more reason that you want to get at least some 
tools in place that law enforcement can use, knowing we don’t real- 
ly know what direction this will go. But at the same time, making 
sure that we protect the privacy interests and I believe, some of the 
state interests, as the witnesses pointed out. Thank you very much. 

Senator Nelson. Senator Klobuchar will be added as a co-spon- 
sor. 

Senator Klobuchar. Thank you. 

Senator Nelson. Senator Sununu? 

STATEMENT OF HON. JOHN E. SUNUNU, 

U.S. SENATOR FROM NEW HAMPSHIRE 

Senator Sununu. Thank you, Mr. Chairman. I just have a couple 
of questions. First let me begin with some basic questions that Sen- 
ator Stevens had and that is just viewing these things from the 
consumers’ perspective. I guess for each of our panel members, 
maybe we can start with Ms. Monteith, if a consumer has concerns 
or is a victim of domestic abuse, or they have a complaint or con- 
cern about these kind of fraudulent activities, is there anything 
they can do to verify the accuracy of Caller ID information that is 
being presented to them through their phone system? 

Ms. Monteith. I do not know the answer to that question, other 
than the information, obviously, is displayed on their customer 
equipment and calling back the telephone number that’s displayed 
to attempt to verify whether or not, in fact, it’s the entity that it 
purports to be, or checking with their telecommunications carriers 
and looking at their call records to determine where calls came 
from. 
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But let me look into that question and I’d be happy to get back 
with you. 

Senator SUNUNU. Thank you. Second and more broadly, there 
certainly was an increase in the number of complaints from 2005 
to 2006 regarding spoofing. The number went from 24 complaints 
to 60 complaints. This year, we’re about halfway through the year. 
We’ve had 30 complaints. It certainly doesn’t represent a dramatic 
increase and I think overall, it’s a relatively modest number. So I 
have two basic questions. First, is that level of activity necessary 
to do a new piece of legislation and the second is whether or not 
the FTC already has the authority to deal with a good deal of the 
fraudulent activity. 

As you know, the FCC has a responsibility and oversight for a 
lot of the IP and broadband voice services. So one, given the level 
of complaints and problems and two, given that the FCC already 
has some authority in this area, is there is a pressing need for new 
legislation and if you think that there is, what specific enforcement 
tools are missing that aren’t available already? 

Ms. Monteith. I can’t comment on the need for legislation. I 
would need to let the Commissioners and the Chairman speak for 
themselves on that matter. I would say that the FCC would inves- 
tigate any consumer complaint, regardless of the number of con- 
sumer complaints that come to us. So in fact, we’re looking at the 
consumer complaints that have been filed with us and have taken 
the initiative to open investigations on this issue when it came to 
our attention. 

Senator SUNUNU. But there’s nothing restricting you from open- 
ing investigations? There’s nothing restricting you from enacting 
penalties where fraudulent activity is found? 

Ms. Monteith. With respect to penalties, two things, I think. 
One, we’ve already testified that it’s not clear that we have the au- 
thority in this area over entities that are not directly regulated by 
the Commission and, in fact, that issue has been raised in response 
to our Letters of Inquiry by some of the targets of our investiga- 
tions. And second 

Senator SuNUNU. Specifically what entities are you talking 
about? As a legislator, I would hope that you don’t have any au- 
thority over entities that aren’t — you don’t specifically have juris- 
diction over. In other words, we set up jurisdictional boundaries for 
the clear purpose of not having overlapping regulations of adminis- 
tration and oversight. So if there are specific entities that you be- 
lieve you ought to have oversight over, you need to be specific 
about that, about where those gray areas might exist. 

But let me — my understanding is you have oversight of telecom 
carriers, which has a long legal history of definition. Go ahead. 

Ms. Monteith. That’s correct. I’m talking about entities that are 
not directly regulated by the Commission, and not commenting on 
whether we ought to have jurisdiction, merely pointing out that 
there is a question mark that has been raised in our investigations 
as to whether we do have jurisdiction, since these entities are not 
directly regulated by the Commission and do not appear to be com- 
mon carriers. 
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Senator SUNUNU. But with regard to those that you do have ju- 
risdiction over, you have the ability to open cases, to carry through 
enforcement and to levy penalties, correct? 

Ms. Monteith. That is correct. 

Senator SuNUNU. Would the other panel members like to com- 
ment? 

[No response.] 

Senator SuNUNU. OK. Is there any specific enforcement tool, put- 
ting aside the issue of coverage or jurisdiction, any enforcement 
tool that any of the panel members want to highlight as being un- 
available right now or lacking right now in current legislation? 

[No response.] 

Senator SUNUNU. OK, thank you, Mr. — I’m sorry, who is — it is a 
Chairman today? Mr. Chairman. Thank you, Mr. Chairman. I don’t 
want any trouble there. Senator Klobuchar’s chair is much larger 
than yours so I was entirely confused. I apologize. 

[Laughter.] 

Senator Klobuchar. We need a visual for that to understand. 
Thank you. 

Senator Nelson. As a matter of fact. I’m surprised that Senator 
Inouye and Senator Stevens allow Senator Rockefeller to have that 
big chair here. But because of his back, he has to have it. 

Senator Klobuchar. And it makes me look too small. Please con- 
tinue. 

Senator Nelson. I want to ask you with the fact that Voice over 
Internet Protocol is increasingly becoming a reality and we esti- 
mate some nine million customers today are using telephone calls 
through VoIP. And the fact that the FCC has jurisdiction directly 
over traditional telephone calls and that VoIP service providers are 
not clearly subject to the same FCC Caller ID regulations. So I 
wanted to ask any of you, do you think that this legislation plugs 
the hole with regard to new technologies like VoIP? 

Ms. Monteith. Yes, it appears to do so. The only issue we might 
bring to your attention. Senator Nelson, is that the definition of 
VoIP that is crafted in the legislation does not include a provision 
for VoIP service that might be provided without a fee. 

Senator Nelson. Without what? 

Ms. Monteith. Without a fee. In other words, some VoIP serv- 
ices may be provided free of charge. 

Senator Nelson. And would that not be within the jurisdiction 
of the FCC? 

Ms. Monteith. Certainly not currently and in reading the legis- 
lation, I believe the legislation defines VoIP as two-way commu- 
nications provided for a fee, directly to the public for a fee. There 
may be some services that are provided 

Senator Nelson. So if we’re trying to get our hands around 
spoofing and we want you to have the regulatory authority, we’ve 
got to make that exception. 

Ms. Monteith. I believe that it might be appropriate to include 
that language and we’d be happy to work with your staff. 

Senator Nelson. OK, thank you for that recommendation. Com- 
missioner Jones, you have stated in your testimony that some tele- 
marketers are using spoofing to avoid the Do Not Call list enforce- 
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ment. Do you think that this legislation will fix that problem? And 
will it make the Do Not Call lists’ enforcement easier for you? 

Mr. Jones. Yes, sir. The legislation goes a long way in address- 
ing that and certainly enforcement will be easier based on the pen- 
alties that are being proposed in there. But of course, that would 
only be honored by those who are not bad actors. But certainly, we 
believe that goes a long way and as I stated earlier, what we be- 
lieve is that what would make it even stronger is to not prohibit 
the states from engaging in a concurrent investigation to the extent 
that state laws allow them to do so. 

Senator Nelson. And you think the legislation as it is written, 
would prohibit the states? 

Mr. Jones. From engaging in concurrent investigations, yes, sir. 

Senator Nelson. OK. Are there any other tools that you see that 
we need on the Federal level to stop all of this practice? 

Mr. Jones. Well, Senator, if I could think about that a little bit 
and get something back to you, I would appreciate that. 

Senator Nelson. Well, while you’re thinking about it, go beyond 
spoofing. 

Mr. Jones. OK. 

Senator Nelson. And are there any other telecommunications re- 
lated scams that we need to examine? 

Mr. Jones. Well, beyond spoofing, I think the major one, which 
is not strictly telecommunications but the convergence of tech- 
nology with the phishing example that was given earlier, which is 
a form of web-based spoofing and the URL redirection that accom- 
panies that, and that’s the part of that particular effort that ren- 
ders the victim unable to know that he or she has been spoofed be- 
cause of the URL redirection. I think, to the extent that that tech- 
nology gap is also considered to be closed, then that certainly will 
go a long way in stopping the spoofing in all of its forms, whether 
it is telecommunications through Caller ID or whether it is web- 
based, along with the URL redirection that accompanies that. 

Senator Nelson. You all have suggested that we add the intent 
to defraud or cause harm. Does anybody disagree with that on the 
panel, if that is needed to be added to the bill? 

Ms. Monteith. Senator Nelson, I don’t know that the Commis- 
sion has taken a position on that and again, I would be happy to 
get back to your staff on that issue, after speaking with the Chair- 
man’s Office and the Commissioner’s. 

Senator Nelson. Well, are there any other tools that you think 
that we need to consider in cracking down on this practice? 

Ms. Monteith. No. I do not. 

Senator Nelson. OK. Senator Klobuchar? 

Senator Klobuchar. You’ve been very helpful. Thank you to all 
four of you. 

Senator Nelson. Well, thank you all. It was a very enlightening 
hearing and we will proceed with your suggestions as we mark up 
the bill next week. Thank you and the hearing is adjourned. 

[Whereupon, at 11:03 a.m., the hearing was adjourned.] 




APPENDIX 


Prepared Statement of Hon. Daniel K. Inouye, U.S. Senator from Hawaii 

Millions of Americans use caller identification services to check the name or num- 
ber of a calling party before they answer the phone. Historically, this information 
has been highly reliable, as attempts to provide false Caller ID information required 
specialized equipment and knowledge. However, with the growth of Internet-based 
calling technologies, the ability to send false Caller ID information has become sig- 
nificantly easier. 

As a result, criminals have seized this opportunity. They rely on sending fraudu- 
lent Caller ID information, a practice known as spoofing, to cloak their identities. 
These con artists gain their victims trust by posing as financial institutions or gov- 
ernment agencies and use that trust to deceptively obtain personal information that 
enables identify theft or other forms of fraud. 

To combat this spoofing problem. Senators Nelson, Snowe, and McCaskill have in- 
troduced legislation S. 704, that would amend the Communications Act to explicitly 
prohibit the transmission of misleading or inaccurate Caller identification in connec- 
tion with traditional phone as well as Voice over Internet Protocol services. 

I support them in these efforts and look forward to the testimony from today’s 
witnesses. 
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